HQMC 20 Aug 04 E R R A T U M. to MCO 3500.27B OPERATIONAL RISK MANAGEMENT (ORM)

HQMC 20 Aug 04 E R R A T U M to MCO 3500.27B OPERATIONAL RISK MANAGEMENT (ORM) 1. For administrative purposes, the Publications Control Number (PCN) has been reidentified. Change the PCN "10203352700" to read: "10203353100". PCN 10203353180

SD MARINE CORPS ORDER 3500.27B From: Commandant of the Marine Corps To: Distribution List Subj: OPERATIONAL RISK MANAGEMENT (ORM) Ref: (a) DoD Instruction 6055.1, DoD Safety and Occupational Health (SOH) Program, August 19, 1998 (b) Joint Military Services Publication Risk Management MCRP 5-12.1.C, February 2001 (c) ORM 1-0, Marine Corps Institute ORM Encl: (1) Introduction to Operational Risk Management (ORM) 1. Situation. The purpose of this Order is to publish policy, provide guidance, and assign responsibility concerning the implementation and standardization of ORM. ORM is an integral part of the decision making process for both Marine Corps military and civilian personnel in all operational and nonoperational activities. 2. Cancellation. MCO 3500.27A and MCO 3500.33. 3. Mission. The primary objective of ORM is to avoid unnecessary risk. Successful implementation of the ORM process will increase mission effectiveness while minimizing unnecessary loss of assets, both personnel and materiel. This Order describes the ORM process and defines ORM terms in the enclosure. 4. Execution a. Commander s Intent and Concept of Operations (1) Commander s Intent (a) All Marine Corps activities shall apply the ORM process in planning, operations, training, and non-operational activities to optimize operational capability and readiness. Commands may publish or update existing orders and standing operating procedures with command-specific applications and requirements as appropriate. (b) Individuals shall apply ORM concepts in operational and non-operational activities. Distribution Statement A: Approved for public release; distribution is unlimited.

(2) Concept of Operations (a) Commandant of the Marine Corps (SD) shall provide policy for ORM in the Marine Corps. (b) Inspector General of the Marine Corps shall evaluate the effectiveness of ORM implementation during inspections. b. Subordinate Element Missions (1) Major subordinate commands shall provide guidance as required to subordinate commands regarding ORM policy implementation. (2) Marine Corps Combat Development Center (a) Establish policy for ORM implementation, and ensure ORM is implemented at all points of accession. (b) Incorporate the ORM process into individual training standards, occupational standards and the Marine Corps Combat Readiness Evaluation System. Incorporate ORM concepts and applications into doctrinal publications. (c) Serve as technical advisor for USMC ORM curricula development. required. (d) Maintain and update ORM training courses as (3) Unit Commanders (a) Apply the ORM process to all aspects of command operations and activities. (b) Incorporate identified hazards, assessments and controls into briefs, notices, and written plans. (c) Conduct a thorough risk assessment for new or complex evolutions, defining acceptable risk and possible contingencies for the evolution. (d) Elevate risk decisions through the chain of command when unable to mitigate identified hazards to an acceptable level. 2

c. Coordinating Instructions. Submit all recommendations concerning this Order to Commandant of the Marine Corps (SD) via the appropriate chain of command. 5. Administration and Logistics. Unit Commanders shall: a. Provide initial and annual refresher training on the process of ORM to all unit personnel. The level of training shall be commensurate with rank, experience, and leadership position. Training shall include the material in references (a) through (c) and this Order. Reference (b) is available at https://www.doctrine.usmc.mil/mcrp/view/mcr5121c/mcr5121c.pdf. Annual training may be accomplished by: (1) Completion of one of the four modules of the USMC ORM Distance Learning Course. (2) Classroom instruction or practical application exercises led by a designated ORM instructor. b. Designate at least one ORM instructor. ORM instructor qualification can be earned by completing all four modules of the USMC ORM Distance Learning Course, the 2 day OPNAV-sponsored Applications and Integration Course, or through graduation from the Aviation Safety Officer or Aviation Safety Command Course. c. Document ORM training in member s training record. 6. Command and Signal a. Signal. This Order is effective immediately upon signature. b. Command. This Order applies to the Marine Corps Total Force. DISTRIBUTION: PCN 10203353100 Copy to: 7000260 (2) 8145001 (1) W. L. NYLAND Assistant Commandant of the Marine Corps 3

INTRODUCTION TO OPERATIONAL RISK MANAGEMENT (ORM) 1. Concept. The ORM process: MCO 3500.27B a. Is a decision making tool used by personnel at all levels to increase operational effectiveness by identifying, assessing, and managing risks. Reducing the potential for loss increases the probability of a successful mission. b. Increases our ability to make informed decisions by providing a formal risk management process. c. Minimizes risk to acceptable levels commensurate with mission accomplishment. The amount of risk we will accept in war is much greater than that we should accept in peace, but the process is the same. Correct application of the ORM process will reduce mishaps and associated costs. 2. Terms. ORM terms: a. Hazard. Any issue, real or potential, that can cause personal injury, death, property damage, mission degradation or damage to environment. b. Hazard Severity. An assessment of the expected consequence, defined by degree of injury, occupational illness, property damage, or equipment loss that could occur from exposure to a hazard. c. Mishap Probability. An assessment of the likelihood that, given exposure to a hazard, a mishap will result. d. Risk. Chance of adverse outcome or bad consequences; such as injury, illness, or loss. Risk level is expressed in terms of hazard probability or severity. e. Risk Assessment. A structured process to identify and assess hazards. An expression of potential harm, described in terms of hazard severity, mishap probability, and exposure to hazards. f. Residual Risk. Risk remaining after controls have been identified and selected. g. Operational Risk Management (ORM). The process of dealing with risk associated with military operations, including risk assessment, risk decision making and implementation of effective risk controls. 1

h. Risk Assessment Code (RAC). An expression of risk associated with a hazard that combines the hazard severity and mishap probability into a single Arabic numeral. 3. Process. The five-step ORM process includes: a. Identify Hazards (Step 1). Begin with an outline or chart of the major steps in the operation (operational analysis). Next, conduct a preliminary hazard analysis by listing all of the hazards associated with each step in the operational analysis along with possible causes for those hazards. b. Assess Hazards (Step 2). For each hazard identified, determine the associated degree of risk in terms of probability and severity. Although not required, the use of a matrix described in paragraph 6c of this enclosure may be helpful in assessing hazards. c. Make Risk Decisions (Step 3). First, develop risk control options. Start with the most serious risk and select controls that will reduce the risk to a minimum consistent with mission accomplishment. With selected controls in place, decide if the residual risk is acceptable and the benefit of the operation outweighs the risk. If risk outweighs benefit or if assistance is required to implement controls, communicate with higher authority in the chain of command. d. Implement Controls (Step 4). The following measures can be used to eliminate hazards or reduce the degree of risk. These are listed by order of preference: (1) Engineering Controls. Controls that use engineering methods to reduce risks by design, material selection, or substitution. (2) Administrative Controls. Controls that reduce risks through specific administrative actions, such as: (a) Providing suitable warnings, markings, placards, signs, and notices. (b) Establishing written policies, programs, instructions and standard operating procedures. (c) Training personnel to recognize hazards and take appropriate precautionary measures. 2

(d) Limiting the exposure to a hazard (either by reducing the number of assets or personnel exposed, or the duration of exposure). MCO 3500.27B (3) Personal Protective Equipment (PPE). Serves as a barrier between personnel and a hazard. PPE should be used when other controls do not reduce the hazard to an acceptable level. e. Supervise (Step 5). Conduct follow-up evaluations of the controls to ensure they remain in place and have the desired effect. Monitor for changes, which may require further ORM. Take corrective action when necessary. 4. ORM Process Levels. The ORM process exists on three levels. Decide which of three levels to use based upon the situation, proficiency level of personnel, and the amount of time and assets available. While it is preferable to perform a deliberate or indepth operational risk management process for all evolutions, the time and resources to do so will not always be available. One of the objectives of ORM training is to develop sufficient proficiency in applying the process so ORM becomes an automatic or intuitive part of our decision making methodology. In the operational environment, leaders should be able to employ this time-critical process to make sound and timely decisions that generate tempo and facilitate decisive results. The three levels are as follows: a. Time-Critical. An on the run mental or oral review of the situation using the five-step process without recording the information on paper is often all that time will allow. The time-critical level of ORM is employed by experienced personnel to consider risk while making decisions in a time-compressed situation. It is the normal level of ORM used during the execution phase of training or operations, as well as in planning during crisis response scenarios. It is particularly helpful in choosing the appropriate course of action when an unplanned event occurs during the execution of a planned operation or daily routine. b. Deliberate. Application of the complete five-step process will aid in planning an operation or evaluating procedures. This level uses primarily experience and brainstorming to identify hazards and develop controls; and is therefore, most effective when done in a group. Examples of deliberate applications include planning of upcoming operations, review of standard operating, maintenance or training procedures, damage control, and disaster response planning. c. In-depth. A process involving a very thorough risk assessment (first two of the five steps). Research of available 3

data, use of diagram and analysis tools, formal testing, or long term tracking of the hazards associated with the operation (sometimes with assistance from technical experts) are used to identify and access the hazards. The in-depth level of ORM is used to more thoroughly study the hazards and associated risk in a complex operation or system, or one in which the hazards are not well understood. Examples of in-depth applications include long-term planning of complex operations, introduction of new equipment, materials and missions, development of tactics and training curricula, and major system overhaul or repair. 5. Principles of ORM. ORM incorporates the following four principles: a. Accept Risk When Benefits Outweigh The Cost. Naval Doctrine Publication 1 and Fleet Marine Force Manual I (WARFIGHTING) state, Risk is inherent in war and is involved in every mission. Risk is also related to gain; normally greater potential gain requires greater risk. Our Marine Corps tradition is built upon principles of seizing the initiative and taking decisive action. The goal of ORM is not to eliminate risk, but to manage the risk so the mission can be accomplished with the minimum amount of loss. b. Accept No Unnecessary Risk. Naval Doctrine Publication 1 and Fleet Marine Force Manual I also state, We should clearly understand that the acceptance of risk does not equate to the imprudent willingness to gamble. Take only risks that are necessary to accomplish the mission. c. Anticipate And Manage Risk By Planning. Risks are more easily controlled when they are identified early in the planning process. d. Make Risk Decisions At The Right Level. ORM decisions are made by the leader directly responsible for the operation. Prudence, experience, judgment, intuition, and situational awareness of leaders directly involved in the planning and execution of the mission are the critical elements in making effective ORM decisions. When the leaders responsible for executing a mission determine the risk associated with that Mission cannot be controlled at the unit level, or goes beyond the commander s stated intent, they shall elevate the decision to their chain of command. 6. Risk Assessment Matrix. A matrix can be used to accomplish the second step of the ORM process. Using a matrix to quantify and prioritize the risk(s) does not lessen the inherently subjective nature of risk assessment. However, a matrix does 4

provide a consistent framework for evaluating risk. Although different matrices may be used for various applications, any risk assessment tool should include the elements of hazard severity and mishap probability. The Risk Assessment Code defined in the matrix represents the degree of risk associated with a hazard considering these two elements. While the degree of risk is subjective in nature, the RAC does accurately reflect the relative amount of perceived risk between various hazards. The example matrix described below is used in naval occupational safety and health assessments. Using the matrix, the RAC is derived as follows: a. Hazard Severity. An assessment of the worst credible consequence that can occur as a result of a hazard. Severity is defined by potential degree of injury, illness, property damage, loss of assets, or effect on mission. The combination of two or more hazards may increase the overall level of risk. Hazard severity categories are assigned as Roman numerals according to the following criteria: (1) Category I. The hazard may cause death, loss of facility/asset, or result in grave damage to national interests. (2) Category II. The hazard may cause severe injury, illness, property damage, damage to national or service interests, or degradation to efficient use of assets. (3) Category III. The hazard may cause minor injury, illness, property damage, damage to national, service, or command interests, or degradation to efficient use of assets. (4) Category IV. The hazard presents a minimal threat to personnel safety or health property, national, service, or command interests or efficient use of assets. b. Mishap Probability. The probability that a hazard will result in a mishap or loss, based on an assessment of such factors as location exposure (cycles or hours of operation), affected populations, experience, or previously established statistical information. Mishap probability will be assigned a letter according to the following criteria: (1) Subcategory A. Likely to occur immediately or within a short period of time. Expected to occur frequently to an individual item or person or continuously to a fleet, inventory, or group. (2) Subcategory B. Probably will occur in time. Expected to occur several times to an individual item or person or frequently to a fleet, inventory, or group. 5

(3) Subcategory C. May occur in time. Can reasonably be expected to occur some time to an individual item or person or several times to a fleet, inventory, or group. (4) Subcategory D. Unlikely to occur. c. RAC. The RAC is an expression of risk that combines the elements of hazard severity and mishap probability. Using the matrix (figure 1), the RAC is expressed as a single Arabic number that can be used to help determine hazard abatement priorities. 6

Risk Matrix SEVERITY PROBABILITY A B C D I 1 1 2 3 II 1 2 3 4 III 2 3 4 5 IV 3 4 5 5 RAC Definitions: 1 - Critical risk 2 Serious risk 3 Moderate risk 4 Minor risk 5 Negligible risk Note 1. In some cases, the worst credible consequence of a hazard may not correspond to the highest RAC for that hazard. For example, one hazard may have two potential consequences. The severity of the worst consequence (I) may be unlikely (D), resulting in a RAC of 3. The severity of the lesser consequence (II) may be probable (B), resulting in a RAC of 2. Therefore, it is also important to consider less severe consequences of a hazard if they are more likely than the worst credible consequence, since this combination may actually present a greater overall risk. Note 2. The ORM process provides an additional tool for commanders to use in reducing risks inherent in military operations. It is not a complete change in the way we approach the operational risk management problem, but rather provides a specific methodology for personnel to anticipate hazards and evaluate risk. Just as we have trained our personnel to focus on the mission, we can train our personnel to evaluate risk as part of the decision making process. As personnel are trained in and use the process, ORM will become intuitive, and applied automatically as a means to aid in quickly developing an effective course of action to accomplish the mission. Figure 1. Risk Matrix. 7